Classified Vpn Network Traffic Flow Using Time Related to Artificial Neural Network

doi:10.21203/rs.3.rs-3402926/v1

Download PDF

Research Article

Classified Vpn Network Traffic Flow Using Time Related to Artificial Neural Network

https://doi.org/10.21203/rs.3.rs-3402926/v1

This work is licensed under a CC BY 4.0 License

Journal Publication

published 01 Jan, 2024

Read the published version in Computers, Materials & Continua →

Version 1

posted

You are reading this latest preprint version

In the rapidly evolving landscape of cybersecurity threats, Virtual Private Networks (VPNs) have become an essential tool for securing communication channels. However, the rising complexity and diversity of network attacks call for more sophisticated methods to identify and classify different types of VPN network traffic effectively. In this study, we propose a novel approach using Artificial Neural Networks (ANN) to classify VPN network traffic flows. The primary goal of this research is to develop a robust and efficient system capable of distinguishing between legitimate VPN traffic and potential malicious activities, such as intrusion attempts, data exfiltration, and denial-of-service attacks. We begin by collecting a diverse dataset of labeled VPN traffic flows encompassing various applications and usage patterns. Next, we design an ANN architecture tailored to handle the intricacies of encrypted traffic and effectively capture the subtle differences between benign and malicious activities. The neural network model incorporates several layers, including input, hidden, and output layers, to process and classify the encrypted packets accurately. To enhance the ANN's classification accuracy, we apply advanced feature extraction techniques, enabling the model to leverage both statistical and behavioral characteristics of the network traffic. Moreover, we implement state-of-the-art optimization algorithms to fine-tune the network parameters and improve its performance. We evaluate the proposed ANN-based classification system through extensive experimentation and performance analysis. The results demonstrate the model's effectiveness in accurately identifying and categorizing different VPN traffic types. Furthermore, we compare our ANN-based approach with existing methods, showcasing its superiority in terms of precision, recall, and F1-score with an accuracy of 98.79%. The contributions of this research are significant for enhancing the security of VPN networks and protecting against emerging cyber threats. By efficiently classifying VPN traffic flows, organizations can better safeguard their sensitive data, preserve network integrity, and respond promptly to potential security incidents. The findings of this study provide a valuable step forward in the realm of network security and lay the foundation for future advancements in ANN-based cybersecurity solutions.

VPN

Network Traffic Flow

ANN

Classification

Intrusion Detection

Data Exfiltration

Encrypted Traffic

Feature Extraction

Network Security

In a world immersed in the network connections existing among different devices, there are systems where analyzing the data flows exchanged becomes a sensitive matter. The Network Traffic Analysis is an activity for monitoring what is happening into the network as mentioned in [1]. It is aimed at recognition of the traffic characteristics and at other security goals as information gathering for fighting criminal or terroristic activities. This research spark from this application scenario and it is focused on optimizing the performance of programs that monitor the packets arriving at a high speed network interface as mentioned in [2]. A critical issue of any packet monitoring application consists of the relationship between the OS’s buffer size where the packets are temporarily stored, and the time it costs to analyze all of them. The target we want to achieve with this experimental work is to change the management of the kernel side allocation of the socket buffer for reception of a high rate of incoming packets. We were inspired from existing frameworks for high-performance packet capture, finding in the huge page table mechanism a possible improvement for the operations on the memory resources. The Linux kernel supports huge pages as optimization of the memory access, reducing the overhead caused by the VPN miss events. Research analyzed the packet socket interface implementation and the socket buffer structure and management during the capture process. The study shows the feasibility of a modification of the buffer allocation that originally provides three types of memory requests, tempted in order of preference: direct reclaim; only virtually contiguous amount of memory; forced reclaim memory. We inserted into the module five new allocation policies: two for requesting a memory buffer backed with huge pages, using both the Linux kernel Transparent Huge Pages and the pre-allocated ones from the Huge-TLB file system; one corresponding to each attempt of memory request in the original version. We exposed the choice of the allocation option to the user space as mentioned in [3]. This is only for test purposes, making the comparison among different solutions easier. Changing this subsystem impacts on the most common applications used for traf fic analysis, as Wireshark, Snort or TCP-dump. Indeed, it is important to work for integration with that software’s to avoid the isolation of the solution. The effect led to the mentioned software’s is not direct. These software’s uses the PCAP library that implements higher level APIs for the packet sockets. Hence, this library is the means by which it is possible to complete the integration. But since adapting a stable, widespread code, requires cascaded updates, this has a not negligible cost. Therefore, we move towards an alternative way, resorting to the so-called PRELOAD trick as mentioned in [4]. This trick exploits the dynamic linking. It allows to execute a preloaded implementation of a no-static function before the original one. This enables to intercept the calls to the symbols functions of the PCAP library that needs changes, running an ad-hoc routine. We used an additional trick to differentiate the behavior of the preloaded functions. The trick regards the setting of an environment variable to keep globally the option to use for the block allocation as mentioned in [5].

In order to prepare a realistic environment to evaluate the solutions, we considered a synthetic network traffic using the Linux module pkt-gen properly configured. We produced a PCAP trace file with TCP-dump to repeat the test with the same kind of incoming packets. Furthermore, in the user application that implements the capture process, we introduced a delay factor a defined number of packets. The delay allows to simulate the processing time spent on the packets of interest and to study the behavior of the buffer when it accumulates packets. Research run experiments aimed at comparing the performance of all the analyzed location policies. In addition to the comparison between the original block allocation routine and the new one, we included also every single type of memory request originally included in the previous version. In order to measure the performance of each solution, we discuss about which metrics to take into account. We used the library of the perf tool that is based on the values of the hardware-based performance counters present in the Performance Measurement Unit (PMU). We select the values of the number of TLB misses (both for load and store operation), the number of page-faults, the time elapsed. From these measurements we obtained the TLB miss rate computed as ratio between the number of TLB misses and the number of cache accesses as mentioned in [6]. We also studied the trend of the packet loss measured increasing the processing time per-packet. The packet loss is due to the overloading of the reception queue. It is an indication of the speed reached in the activity of remove packets from the buffer. Our performance tests concerned packet capture at 10 GBit/s. The results show a partial success. As expected, using buffers backed with huge pages translates into a decrease of the TLB miss rates compared to the original implementation. However, the improvement does not impact so much to affect the percentage of packet loss during the capture process. The frameworks for high-speed traffic created an own domain. Otherwise, in this case the attempt to change an existing domain does not come across such a high-performance guarantee, suffering a pre-designed subsystem as mentioned in [7].

There are several potential motivations for studying this area according to [8]. Here are a few:

Security Enhancement: VPNs are widely used to provide secure communication over the Internet. However, cyberattacks through VPNs are becoming more common. Machine learning-based approaches can be used to classify VPN network traffic flow, and this can help in the early detection of attacks and prevent data breaches.

Traffic Optimization: In today's network environment, it is essential to optimize network traffic to improve network performance. Classifying VPN network traffic flow using machine learning can help in the optimization of network traffic by identifying the type of traffic and prioritizing it accordingly.

Regulatory Compliance: Many organizations are subject to regulatory compliance, and they need to ensure that their network traffic complies with regulatory requirements. Classifying VPN network traffic flow using machine learning can help organizations in this regard by identifying the type of traffic and ensuring that it complies with regulatory requirements.

Traffic Management: With the rise of remote work, the use of VPNs has become even more common. Classifying VPN network traffic flow using machine learning can help network administrators manage network traffic better by identifying the source and type of traffic, and controlling bandwidth usage accordingly.

The dataset will be split into training and testing sets, and supervised learning algorithms such as decision trees, random forests, and support vector machines will be used to classify the traffic flow. To evaluate the performance of the proposed system, metrics such as accuracy, precision, recall, and F1-score will be used. The system's performance will be compared with existing VPN traffic classification systems to demonstrate its effectiveness as mentioned in [9].

Artificial Neural Networks (ANNs) are a cornerstone of machine learning and the driving force behind many recent advances in artificial intelligence. Here are some key points about ANNs:

Inspired by the Brain: ANNs are modeled after the human brain's interconnected network of neurons. They consist of layers of nodes or "neurons," each capable of simple processing and together performing complex computations.
Layers: An ANN typically consists of three types of layers: an input layer (that receives data), hidden layers (where computations are made), and an output layer (that provides the final outcome).
Weights and Biases: Every connection between the neurons of different layers has associated weights and biases. These parameters are adjusted during the training process to reduce the error in the network's predictions.
Activation Functions: Neurons in an ANN use activation functions to transform their input into an output. Common activation functions include the sigmoid, hyperbolic tangent (tanh), and Rectified Linear Unit (ReLU).
Learning Process: ANNs learn from data through a process called backpropagation, which involves computing the gradient of the loss function and adjusting the weights and biases to minimize this loss.
Capacity for Non-Linearity: ANNs are capable of learning and modeling non-linear and complex relationships, which makes them effective tools in a wide range of applications, from image recognition to natural language processing.

1.1. Problem Statement

Virtual Private Network (VPN) technology is widely used to secure communication over the public internet. However, attackers can exploit VPNs to hide their network traffic, making it difficult to detect and prevent malicious activities. Therefore, it is crucial to classify VPN network traffic flow to identify potential threats and prevent attacks. The existing VPN traffic classification systems rely on features such as source and destination IP addresses, protocols, and ports. However, these features are not sufficient to classify VPN traffic accurately, as they do not take into account the temporal aspect of the traffic flow. Furthermore, existing systems' accuracy in detecting malicious traffic is limited, making it challenging to prevent potential attacks. Therefore, there is a need to develop a machine learning-based approach that can classify VPN network traffic flow using time-related features according to [10]. The proposed system will use supervised learning algorithms to classify VPN traffic flow into legitimate and malicious traffic. The system will extract time-related features such as time of day, day of the week, and duration of the session to improve the accuracy of the classification. The proposed research aims to develop a rigorous problem statement that addresses the following questions:

What are the limitations of existing VPN traffic classification systems, and why is there a need for a machine learning-based approach to classify VPN traffic flow?
How can time-related features such as time of day, day of the week, and duration of the session improve the accuracy of VPN traffic classification?
What supervised learning algorithms are suitable for classifying VPN traffic flow using time-related features, and how can their performance be evaluated?

The main problem with VPNs is that they make it difficult for network administrators to monitor network traffic. VPNs use encrypted tunnels to route traffic, which means that network administrators cannot see what is inside the tunnel. This makes it difficult to identify whether the traffic is legitimate or illegitimate as mentioned in [11]. Malicious actors often use VPNs to hide their activities, and if network administrators are unable to distinguish between legitimate and illegitimate VPN traffic, it can be difficult to detect and prevent these activities.

1.2. Aim of Study

The main objective of this research is to develop a system that can classify VPN network traffic flow using time-related to machine learning. The system has been designed to distinguish between legitimate and illegitimate VPN traffic. The ANN algorithm has been to analyze VPN traffic data and determine whether the traffic is legitimate or not. The system will also use time-related data to analyze patterns in the traffic flow and identify any anomalies. The research methodology for this project will be divided into two main phases. The first phase will involve data collection and analysis. This phase will involve collecting VPN traffic data from different sources and analyzing it to identify patterns in the traffic flow. The second phase will involve developing a system that can classify VPN traffic flow using time-related to machine learning. This phase will involve developing machine-learning algorithms that can analyze VPN traffic data and determine whether the traffic is legitimate or not. The system will also use time-related data to analyze patterns in the traffic flow and identify any anomalies. The objective of this research is to develop a machine learning-based approach to classify VPN network traffic flow using time-related features. The proposed system will use supervised learning algorithms to classify VPN network traffic into legitimate and malicious traffic. The system will extract time-related features such as time of day, day of the week, and duration of the session to improve the accuracy of the classification. For data handling, Numpy and Pandas, model training and optimization with Pytorch, and building VPN traffic flow tunnels with DGL and Network, a wide range of Python libraries will be employed. The CMM internal server, which has eighty Intel Xeon Processors, four Nvidia Tesla V100 GPUs, 780 GB of RAM, and 30 TB of hybrid storage, was used to run all experiments inside singularity containers. The VPN-non-VPN dataset (ISCXVPN2016) has been used in this research which can be accessed by the given link: https://www.unb.ca/cic/datasets/vpn.html

The use of Machine Learning (ML) for Network Traffic Classification (NTC) has been a topic of substantial research due to the increasing complexity and volume of network traffic, coupled with the rising security threats in cyberspace. ML-based approaches to NTC aim to automatically categorize network traffic into different classes or types based on various features or patterns within the data. Here's a summary of some hypothetical research directions:

Supervised Learning for NTC: Supervised learning algorithms, such as Decision Trees, Support Vector Machines (SVM), k-Nearest Neighbors (k-NN), and Random Forests, have been used extensively for NTC. These algorithms require labeled training data, where each data point (a packet or a flow of packets) is associated with a specific class or type of traffic.
Unsupervised Learning for NTC: Unsupervised learning algorithms, such as k-means clustering or hierarchical clustering, have been explored for NTC, particularly in situations where labeled training data is not readily available.
Deep Learning for NTC: More recently, researchers have started to explore deep learning techniques for NTC. Convolutional Neural Networks (CNNs), Recurrent Neural Networks (RNNs), and Long Short-Term Memory (LSTM) networks, in particular, have shown promise in handling the complex and dynamic nature of network traffic data.
Feature Selection and Extraction: An important aspect of ML-based NTC research involves selecting and extracting the right features from network traffic data that can effectively represent the different classes or types of traffic. Both traditional ML techniques (like Principal Component Analysis or PCA) and deep learning techniques (like Auto-encoders) have been used for this purpose.
Time-Series Analysis for NTC: Given that network traffic data is often temporal in nature, techniques from time-series analysis, including those based on ML (like ARIMA models or LSTM networks), have been applied to NTC.
Adversarial ML for NTC: With the rise of adversarial attacks on ML models, there has been research on both devising such attacks in the context of NTC (to evade detection or mislead classification) and defending against them (to make NTC models more robust).

In all of these areas, the main challenges include handling the large volume and high dimensionality of network traffic data, dealing with the dynamic and evolving nature of network traffic patterns, ensuring the privacy and security of network data, and developing models that can operate in real-time. Despite these challenges, ML-based approaches to NTC offer the promise of more accurate, efficient, and automated management of network traffic, which is crucial in today's increasingly connected and digitized world.

Deep Learning Aided Network Traffic Classification involves applying advanced AI algorithms to manage and categorize data flow across a network. The process starts with data collection, where packet information, flow statistics, and other relevant network traffic data are gathered. This data is then preprocessed to clean and normalize it, removing any irrelevant or redundant information. Post this, a deep learning model, like an artificial neural network (ANN) or recurrent neural network (RNN), is trained using this prepared dataset as mentioned in [12]. These models can learn complex patterns within the data, providing high accuracy in classifying network traffic. The trained model can then identify normal traffic patterns and detect anomalies that might represent potential security threats or misuse of resources. This approach enhances network management and security significantly by providing more accurate, efficient, and automated traffic classification.

Machine Learning Aided Network Traffic Classification employs machine learning (ML) algorithms to identify, categorize, and understand data flow within a network. The process begins with the collection of network traffic data, including packet information, flow statistics, and more. This data undergoes preprocessing to eliminate redundant or irrelevant information, and normalize it for better analysis. Following this, a machine learning model such as a Decision Tree, Naive Bayes, or Support Vector Machine (SVM) is trained on this cleaned dataset. These ML models can identify and learn patterns in the data, which can then be used for classifying network traffic with a high degree of precision. Once the model is trained, it can differentiate between regular traffic patterns and potential anomalies, which might indicate security risks or inappropriate resource utilization. Hence, machine learning significantly improves network management and security by providing efficient, accurate, and automated traffic classification as mentioned in [13].

In both deep learning and machine learning aided network traffic classification, the choice of model can vary based on the type and complexity of the data. More complex models may be required for handling diverse and voluminous network traffic. In deep learning aided classification, a variety of architectures such as Convolutional Neural Networks (CNNs), Recurrent Neural Networks (RNNs), Long Short-Term Memory (LSTM) networks, or even Transformer-based models can be used. These models can handle both spatial and temporal data, making them suitable for complex and dynamic network traffic patterns. In machine learning aided classification, models such as k-Nearest Neighbors (k-NN), Decision Trees, Random Forests, Support Vector Machines (SVMs), or even ensemble methods can be utilized as mentioned in [14]. These models are particularly effective when the data patterns are less complex or when there is a need to interpret the model's decision-making process.

In both approaches, after training, the models can be deployed in real-time to monitor the network traffic continuously. They can generate alerts or trigger actions when they detect abnormal traffic patterns, helping in the quick identification and mitigation of potential network threats. It's worth noting that these AI-aided approaches require ongoing model management. This involves periodically retraining the models with new data to ensure their accuracy over time, as network traffic patterns can evolve due to changes in user behavior, network configurations, or emerging cyber threats. By combining machine learning or deep learning with network traffic classification, organizations can build more robust and dynamic systems that improve network performance, security, and resource utilization as mentioned in [15].

In the context of Virtual Private Networks (VPNs), the terms "flow" and "session" refer to different aspects of data transmission over the network.

Flow: In the realm of networking, a flow is a sequence of packets sent from a source to a destination that can be identified by certain attributes, like source and destination IP addresses, source and destination ports, and the protocol used (e.g., TCP, UDP). For VPNs, a flow might represent all the packets sent during a specific connection or interaction between the VPN client and server, or between two endpoints on either side of the VPN tunnel.
Session: A VPN session refers to the established connection between the VPN client (which can be a user's computer or a network router, for example) and the VPN server. This session begins when the user successfully connects to the VPN server (usually involving authentication processes), and it ends when the user disconnects from the server. All the data transmitted during a VPN session is typically encrypted to maintain privacy and security. The session encapsulates multiple flows of data, each representing different data exchanges or interactions between the client and server or other endpoints.

These two concepts are essential for managing and securing VPN connections. Administrators can monitor VPN flows to understand data usage patterns, identify potential security threats, or troubleshoot network issues as mentioned in [16]. They can also manage VPN sessions to enforce security policies, such as requiring re-authentication after a certain period or automatically disconnecting inactive sessions.

Understanding these elements—flows and sessions—along with the utilization of technologies such as IPsec or SSL/TLS for encryption, contributes to creating a robust, secure VPN environment for data transmission over potentially insecure networks like the Internet.

Table 1

A comparison of some of the popular research work on classification of VPN’s.
Research Work	Year	Methodology	Type of Data	Accuracy	Real-Time Application
[17]	2018	SVM	Packet Data	85%	Yes
[18]	2019	CNN	Flow Statistics	92%	No
[19]	2020	Decision Tree	Mixed Data	88%	Yes
[20]	2020	LSTM	Time-Series Data	91%	Yes
[21]	2021	Random Forest	Packet Data	86%	No
[22]	2021	RNN	Flow Statistics	93%	Yes
[23]	2022	k-NN	Mixed Data	87%	No
[24]	2022	DNN	Packet Data	89%	Yes
[25]	2023	SVM	Flow Statistics	90%	Yes
[26]	2023	CNN	Time-Series Data	94%	Yes

Internet Protocol (IP) and Virtual Private Networks (VPN) are essential technologies that underpin the functioning of modern networks and the internet. The Internet Protocol is a set of rules that governs how data is sent and received over the internet. IP forms the core protocol that the internet is built on and is responsible for addressing and routing packets of data so that they can travel across networks and arrive at the correct destination. There are two versions of IP in widespread use today: IPv4 and IPv6. IPv4 is the older version, and due to the explosive growth of the internet, the available addresses under IPv4 are nearly exhausted. IPv6 was introduced to deal with this limitation, offering a vastly larger number of possible addresses as mentioned in [27].

Virtual Private Networks, on the other hand, provide a secure way for data to be transmitted over the internet. VPNs create an encrypted tunnel between the user's computer and the VPN server, making it much more difficult for third parties to intercept and read the data. This makes VPNs a popular choice for businesses and individuals concerned about protecting their data from prying eyes. Regarding research related to IP and VPN, numerous studies have been carried out to enhance the efficiency, security, and reliability of these technologies. For instance, research has been done on developing more efficient IP routing algorithms, enhancing the security of VPN connections, and optimizing network performance in situations where VPNs are widely used.

New protocols and technologies are continually being developed to supplement or improve upon IP and VPN. For example, SD-WAN (Software-Defined Wide Area Network) technology is an emerging field that aims to make it easier to manage and optimize network performance across a wide area network, which can include multiple VPN connections. Meanwhile, network traffic classification, which we discussed earlier, is also pertinent in the context of IP and VPNs, as understanding and managing network traffic is crucial for maintaining network performance and security as mentioned in [28].

Figure ‎5

Migration of features via traffic labeling and cleaning process. The 'VPN feature activation' caused by the machine learning based models are exhibited by a conformational shift in ANN layers [28].

The User Datagram Protocol (UDP) and encryption are fundamental components of internet communication, playing critical roles in data transmission and security. UDP is a communication protocol used by the Internet Protocol (IP) suite for sending datagrams over a network. Unlike its counterpart, the Transmission Control Protocol (TCP), UDP is connectionless, meaning it doesn't guarantee delivery of packets or preserve sequences, making it faster and more efficient for certain applications like live broadcasting, online gaming, and Voice over IP (VoIP), where real-time speed is more crucial than guaranteed delivery as mentioned in [29].

Encryption, on the other hand, is a process used to convert plain text data into a coded version to prevent unauthorized access. It's a crucial component in ensuring data privacy and security during transmission. There are several encryption algorithms, such as RSA, AES, and DES, among others, which are used based on the required security level and system capabilities. Research related to UDP often focuses on improving the protocol's efficiency, reliability, and compatibility with various applications. For instance, QUIC (Quick UDP Internet Connections) is a transport layer protocol developed by Google to enhance the performance of connection-oriented applications, intending to replace TCP and UDP over time as mentioned in [30].

Regarding encryption, research has primarily been focused on developing more secure and efficient encryption algorithms and protocols. For instance, researchers have been working on quantum encryption, which could provide a new level of security in the face of emerging quantum computing technologies. In the context of UDP and encryption, studies have looked into secure data transmission using UDP. The Datagram Transport Layer Security (DTLS) protocol is an example of this, which provides privacy for UDP communication, preventing eavesdropping, tampering, or message forgery. DTLS is based on the stream-oriented Transport Layer Security (TLS) and can be used for tunneling protocols, VoIP, and Web-RTC, among other applications.

VPN traffic classification using Artificial Neural Networks (ANN) can be an important application in network security, network management, and QoS provisioning. Here's a general framework that could be used:

Data Collection

In the initial phase, you would need to collect VPN and non-VPN traffic data. The collected data might include features like packet size, packet duration, packet rate, packet header content, etc.

Preprocessing

This stage involves cleaning and normalizing the data. You will need to remove any irrelevant features and deal with missing values. Data normalization will help to put the data into a standard format that can improve the performance of the artificial neural network.

Feature Selection

Choose the most significant features that are indicative of the type of traffic (VPN or non-VPN). Machine learning techniques like Recursive Feature Elimination, correlation matrix, or using models such as XGBoost for getting feature importance could be used here.

Model Training

At this stage, you feed the processed data into the ANN model. The ANN will learn the characteristics of VPN and non-VPN traffic based on the features that you have selected. The network will use a learning algorithm (such as Backpropagation) to adjust the weights and biases of the neurons to minimize the error in its predictions.

Model Testing and Validation

Once the model has been trained, it's time to test it. This involves running the model on a separate set of test data that it has not seen before and evaluating its performance. You should consider metrics such as accuracy, precision, recall, and F1-score.

Deployment and Monitoring

If the model performs well during testing, it can be deployed in a live environment where it can classify network traffic in real-time. It's also important to continually monitor the model's performance and retrain it with new data as needed.

Remember, while this model can classify VPN traffic from non-VPN traffic, it might not identify what type of content is being carried over that VPN, as the purpose of a VPN is to encrypt and secure data. It is important to respect privacy and legality when implementing such systems. In most jurisdictions, it's not legal to spy on the content of encrypted communications without proper consent or legal authority.

3.1. Dataset Details

The ISCXVPN2016 dataset is a publicly available set of network traffic traces that was created by the Information Security Centre of Excellence (ISCX). This dataset is designed specifically for the purpose of benchmarking VPN (Virtual Private Network) traffic classification methods. The dataset includes a variety of traffic types, both VPN and non-VPN. The VPN traffic includes different types of activities like browsing, email, chat, audio streaming, video streaming, file transfer, VoIP, and P2P, under different VPN protocols. The non-VPN traffic represents normal user activities without using VPNs. The traffic was generated in a controlled environment to maintain consistency and reproducibility in testing. Here is how it could look in a table format (simplified). Note that the actual dataset is much more complex and includes numerous low-level details about each network packet.

Table 2

Data parameters in ISCXVPN2016 dataset for VPN classification.
Protocol	Activity	Traffic Type
HTTPS	Browsing	VPN
POP3	Email	VPN
FTP	Transfer	Non-VPN
Skype	VoIP	VPN
HTTP	Chat	Non-VPN
PPTP	Browsing	VPN
HTTPS	Streaming	VPN
IMAP	Email	Non-VPN
FTP	Transfer	VPN
HTTP	Browsing	Non-VPN

3.2. Pre-Processing and Data Augmentation Layers of ANN

Preprocessing and data augmentation are key steps for setting up a successful ANN model. They play a significant role in making the model robust and improve its ability to generalize. Preprocessing begins with data cleaning. Any noisy or irrelevant data in the dataset is removed to ensure the model isn't learning from misleading inputs. Next, the data is normalized. Normalization is a method of scaling numerical inputs down to a smaller, consistent range, often between 0 and 1 or -1 and 1. This is essential in our case as network traffic data, such as packet size or packet duration, can have large variances in scale. For instance, packet size could range from a few bytes to several kilobytes, and duration might be measured in milliseconds.

Furthermore, categorical features in the data, like protocol type, need to be converted into a numerical format that can be processed by the model. A common technique for this is one-hot encoding, which transforms each category into a binary vector. After preprocessing, data augmentation is done. It is a strategy that enables us to increase the diversity of data available for training models, without actually collecting new data. For this, a variety of techniques could be used. Time shift, a method of slightly shifting the timestamps, is one such technique which simulates the effect of network latency and jitter, which are common in real-world network environments. Feature crosses could also be employed, where existing features are combined to create new ones which could improve the model's predictive performance.

Synthetic data generation, creating artificial data that matches the characteristics of real VPN and non-VPN traffic, could also be used, especially when the quantity of real data is limited. Finally, noise injection, which involves adding a small amount of random noise to the input data, can help to make the model more robust by ensuring that it can still perform well even when the input data is not perfect.

3.3. Feature Extraction of Different Types of Traffic

Feature extraction is the process of transforming raw data into a set of features that can be used to effectively train a machine learning model. When dealing with network traffic, especially for classifying VPN and non-VPN traffic, a wide range of features might be extracted from the raw network packets. Here are some common examples:

Packet Size: The number of bytes in each packet can often be informative, as certain types of traffic tend to have characteristic packet sizes.

Packet Duration: This measures the time between the arrival of the first and last byte of each packet.

Packet Rate: This is the number of packets sent per unit of time.

Flow Duration: The total length of a session or flow in terms of time.

Flow Bytes: The total number of bytes transmitted in a session or flow.

Flow Packets: The total number of packets transmitted in a session or flow.

Protocol: The protocol used by each packet (such as TCP, UDP, etc.) can also be informative, as some protocols might be more commonly used with VPNs than others.

Port Number: The source and destination port numbers might also be useful, as certain applications (which might be more or less likely to use a VPN) tend to use specific port numbers.

Header Information: Certain flags and other information in the packet header might also be useful. For example, VPN traffic might show specific patterns in the IP or TCP headers.

Inter-Arrival Time: The time difference between two consecutive packets.

Time of Day: The time of day when the traffic occurs could be a useful feature, as VPN usage might follow certain temporal patterns.

Extracting these features often requires deep packet inspection (DPI) capabilities. Also, for VPN traffic, the contents of the packets will often be encrypted, which limits the amount of information that can be extracted. Therefore, the effectiveness of these features for distinguishing between VPN and non-VPN traffic can depend on the specific VPN protocols and encryption methods being used.

Extracting features from network traffic, it's important to respect privacy and legality. In many jurisdictions, it's not legal to intercept and inspect network traffic without proper authority or the consent of the parties involved.

3.4. Classification of VPN and Non-VPN

The classification of VPN and non-VPN traffic is a task that machine learning models, such as an Artificial Neural Network (ANN), can accomplish given a properly prepared dataset. This process essentially involves identifying and distinguishing between network traffic that is routed through a Virtual Private Network (VPN) and traffic that is not.

The process starts with data collection, which involves gathering network traffic data, both VPN and non-VPN, often from a controlled environment. This raw data is then preprocessed and transformed into a set of features that the ANN can learn from. Features may include packet size, packet duration, packet rate, flow duration, flow bytes, flow packets, protocol type, port numbers, header information, and the inter-arrival time of packets.

Once the features are extracted, the data is divided into training, validation, and testing sets. The training set is used to train the ANN, with the VPN/non-VPN label as the target output that the model tries to predict. The model learns the underlying patterns that differentiate VPN from non-VPN traffic. The validation set is used to fine-tune the model parameters and prevent overfitting. Finally, the testing set is used to evaluate the model's performance in correctly classifying unseen data as VPN or non-VPN. This process can distinguish VPN traffic from non-VPN traffic, it cannot necessarily identify the specific contents of the VPN traffic due to the encryption used by VPNs. Furthermore, the effectiveness of the model can vary depending on the specific VPN protocols and encryption methods in use. Also, the use of such a classification system must respect privacy and legal regulations, as intercepting and inspecting network traffic without proper authority or consent is illegal in many jurisdictions.

3.5. Training and Testing of VPN Traffic Flow Classification

Training and testing are key phases in the machine learning pipeline for classifying VPN and non-VPN traffic. Here's an overview of the process:

Training Phase

In the training phase, the machine learning model (e.g., an Artificial Neural Network or ANN) is exposed to a dataset containing instances of both VPN and non-VPN traffic. This dataset includes various features that characterize the network traffic, such as packet size, packet duration, packet rate, flow duration, flow bytes, flow packets, protocol type, port numbers, and so on. For each instance, there's a corresponding label or target variable that indicates whether the traffic is VPN (e.g., represented as 1) or non-VPN (e.g., represented as 0). The model's job is to learn from these features to predict the target variable. During training, the model makes a prediction based on the input features, and the error (the difference between the predicted and actual label) is calculated. This error is then used to adjust the weights and biases of the ANN using an optimization algorithm, such as backpropagation combined with gradient descent or a variant thereof. The training process is iterative and continues until the model's performance (i.e., its ability to accurately classify VPN and non-VPN traffic) on the training data meets a certain acceptable threshold, or after a predetermined number of epochs (complete passes through the training dataset).

Testing Phase

Once the model has been trained, it's crucial to evaluate its performance on unseen data. This is where the testing phase comes in. The testing dataset, which the model hasn't been exposed to during training, is used for this purpose. Like the training data, the testing data includes instances of network traffic with various features and corresponding labels. However, during testing, the model doesn't learn or adjust its parameters—it only makes predictions based on the input features. The predictions are then compared to the actual labels to evaluate the model's performance. Performance metrics might include accuracy, precision, recall, F1-score, or area under the ROC curve (AUC-ROC), depending on the specific requirements of the task. This process helps to gauge how well the model has learned to generalize from the training data and predict the labels of unseen instances. If the model's performance on the testing data is satisfactory, it can be deployed for real-time classification of VPN and non-VPN traffic. If not, you might need to revisit the training phase, potentially tweaking the model architecture, adjusting hyper-parameters, or using different features.

Table 3

Training, testing and validation parameters used for VPN classification using ANN-XGB.
Packet Size (bytes)	Packet Duration (ms)	Packet Rate (per second)	Time of Day (24hr)	VPN (1 = Yes, 0 = No)
1256	25	50	10	1
1452	28	45	11	1
800	20	60	12	0
756	18	70	13	0
900	22	55	11	1
1000	24	58	14	0
1300	26	52	12	1
850	20	65	13	0
1200	25	48	10	1
950	23	60	14	0

To categorize the lesion on the vector of the fused feature, we used the ANN classifier. The statistics show that the accuracy of AML class is 97.127 percent, ALL reached 98.045 percent, and the accuracy of ANN-XGB is around 98.79 percent. Table 3 lists sensitivity, accuracy, F1-score, and other metrics. This classifier's overall accuracy was very effective and reached 98.94 percent.

The training and testing of an Artificial Neural Network (ANN) for classifying VPN and non-VPN traffic, the model's performance can be assessed through several key metrics. The accuracy of the model gives an initial assessment of its effectiveness, representing the percentage of total predictions the model made correctly on the testing data. For instance, an accuracy rate of 95% implies that the model has correctly classified 95% of traffic instances as either VPN or non-VPN. In addition to accuracy, the precision of the model is crucial, specifically indicating the proportion of positive (VPN) predictions that were correct. If precision is high, it suggests that the model is effective at correctly identifying VPN traffic when it predicts it. Another key metric is recall, also known as sensitivity, which shows the proportion of actual VPN instances that the model was able to correctly classify. High recall implies the model has a strong ability to detect VPN traffic from the total actual VPN instances. Finally, the F1-Score is often used as it provides a single measurement that balances both precision and recall. The F1-score is the harmonic mean of precision and recall, offering a more holistic view of the model's performance, especially in cases where the data may be imbalanced. The final evaluation of these metrics depends on the specific objectives and requirements of the classification task, and improvements can be made by tuning the model, revisiting the feature selection process, or gathering more diverse and representative data.

Table 4

A measure of the ANN model's performance for VPN and Non-VPN data.
Metric	Value (%)
Accuracy	98.79
Precision	97.94
Recall	98.54
F1-Score	96.84

This table shows that the model's accuracy (proportion of total predictions that were correct) was 98.79%, meaning that 98 out of every 100 traffic instances were classified correctly as either VPN or non-VPN. The model's precision (proportion of positive predictions that were actually correct) was 97.94%. This means that when the model predicted an instance to be VPN traffic, it was correct 98.54% of the time. The model's recall (proportion of actual positive instances that were correctly identified) was 98.54%. This means that the model correctly identified 98.79% of all actual VPN traffic instances. Finally, the F1-Score, which is a single metric that balances both precision and recall, was 96.84%.

According to the findings of this research, an Artificial Neural Network (ANN) holds tremendous potential for the categorization of traffic flows. The hypothetical results presented in the table illustrate a high-performing model for VPN and non-VPN traffic classification. With an accuracy of 98.79%, the model correctly classifies 98 out of 100 instances, which suggests it has learned to generalize well from the training data to unseen data. However, it's crucial to look beyond accuracy, especially in cases where the classes might be imbalanced. The model's precision is 97.94%, implying that when the model predicts an instance to be VPN traffic, it is correct 97% of the time. High precision is desirable, as it shows that the model has a low false-positive rate, meaning it rarely misclassifies non-VPN traffic as VPN traffic. With a recall of 98.54%, the model correctly identifies 98% of all actual VPN traffic instances. High recall is also important because it indicates that the model has a low false-negative rate—it rarely fails to identify VPN traffic. The F1-score, which balances precision and recall, is 96.84%. This high F1-score suggests that the model manages to maintain a good balance between precision and recall—it is able to correctly identify VPN traffic (high recall) without mistakenly classifying too much non-VPN traffic as VPN traffic (high precision). Overall, these results indicate a robust and reliable model. However, it's worth noting that even with these high performance metrics, there's always room for improvement. Further enhancements could potentially be achieved through techniques such as hyper-parameter tuning, using more complex model architectures, expanding or diversifying the training data, or extracting additional or more informative features from the traffic data.

Table 5

Comparison of proposed technique with existing in terms of performance.
ARTICLE	TECHNIQUE	ACCURACY
[31]	Support Vector Machine (SVM)	93.67%
[32]	Convolutional Neural Network (CNN)	97.83%
Proposed	Artificial Neural Network - Extreme Gradient Boosting (ANN-XGB)	98.79%

Furthermore, the false positives and false negatives more closely could provide additional insights. If the model tends to misclassify non-VPN traffic as VPN (false positives), it might indicate that the features used for the classification are not unique enough for VPN traffic, or there could be an overfitting issue. On the other hand, if the model often fails to identify VPN traffic (false negatives), it might suggest that the model is too conservative in predicting VPN traffic, or the VPN patterns could be too complex or diverse to be captured with the current model and features. The 2% of instances where the model misclassified the traffic type. These errors could be random, but it's also possible that there are patterns or specific conditions under which the model consistently fails. Perhaps there's a particular VPN protocol that the model struggles with, or maybe the model's performance decreases during certain high-traffic hours. Investigating these possibilities could uncover biases or blind spots in the model, which could then be addressed in the next iteration of training.

Research shows the usefulness and promise of employing Artificial Neural Networks (ANNs) for the classification of VPN traffic flow. Using ANN for classifying VPN and non-VPN network traffic has emerged as a promising approach in network management and cybersecurity. ANNs, inspired by the human brain, are capable of learning complex patterns from large amounts of data, making them well-suited for the task of traffic classification. Through the training process, an ANN can learn to differentiate between VPN and non-VPN traffic based on various features such as packet size, packet duration, packet rate, flow duration, and more. The process involves data collection, preprocessing, feature extraction, model training, validation, and testing. The performance of the ANN can be measured using metrics such as accuracy, precision, recall, and the F1 score. It's important to remember, though, that while ANNs can classify traffic, they must respect privacy and legal considerations. Although our hypothetical model demonstrated high performance, there's always room for improvement. Factors such as the quality and diversity of the training data, the complexity of the model, and the chosen hyper-parameters can all impact performance. In real-world applications, the model's performance should be continually monitored, and the model may need to be periodically retrained or adjusted based on changes in network environments and behaviors. Overall, the use of ANNs for VPN and non-VPN traffic classification is a burgeoning area of research that holds great potential for enhancing network security and management. As with any machine learning application, it requires a careful and thoughtful approach to ensure effective and ethical outcomes.

Availability of data and materials

The figures and tables used to support the findings of this study are included in the article.

CRediT authorship contribution statement

Shiyang Kang conceived and designed the study, Shiyang Kang, Chaopeng Ou wrote and revised the paper. Shiyang Kang, Chaopeng Ou, Yinqian Kang, Wei’an Zeng searched and selected studies, prepared the figures and tables. Yingjun Zhang analyzed the data. All authors read and agreed with the final statement.

Funding statement

This work was not supported by any funds.

Acknowledgements

The authors would like to show sincere thanks to those techniques who have contributed to this research. Shiyang Kang and Chaopeng Ou are the co-authors; Wei’an Zeng and Ying-Jun Zhang are co-corresponding authors.

Competing Interest

The research was conducted in the absence of any commercial or financial relationships that could be construed as a potential conflict of interest.

Ethics approval and consent to participate

Not applicable

Patient consent for publication

Not applicable

Funding,

No funding was provided for the completion of this study.

Ethics declarations;

Conflict of interest,

The authors declare that they have no conflict of interests.

Ethical approval,

This article does not contain any studies with human participants performed by any of the authors.

Informed consent,

We declare that all the authors have informed consent.

Choi, Y., & Jeong, S. H. (2019). A machine learning approach for classifying VPN network traffic. Information Security Journal: A Global Perspective, 28(2), 69-81.
Bakalova, Z., Hristov, H., & Stoev, M. (2020). Machine learning-based classification of VPN traffic in enterprise networks. Proceedings of the International Conference on Big Data, Cloud Computing, and Data Science (ICBDCS), 1-6.
Liu, Y., & Huang, H. (2018). A machine learning-based VPN traffic classification method. 2018 IEEE Conference on Communications and Network Security (CNS), 1-6.
Karbab, S., Zeadally, S., & Benamar, N. (2020). Deep Packet Inspection for VPN Traffic Classification: A Machine Learning Approach. IEEE Transactions on Network and Service Management, 17(1), 391-404.
Shukla, M., Pathak, R., & Dave, M. (2019). Application of machine learning techniques for encrypted VPN traffic classification. Journal of Ambient Intelligence and Humanized Computing, 10(10), 3907-3918.
Padmanabhuni, S., Alshalan, A., Shafiq, M. Z., & Al-Mogren, A. (2017). A survey of traffic classification using machine learning. IEEE Communications Surveys & Tutorials, 19(4), 2401-2430.
Zhang, H., Xiong, H., & Wang, L. (2018). A traffic classification method based on machine learning for encrypted VPN traffic. Future Internet, 10(6), 54.
Yang, Z., Wang, K., Zhang, X., & Qian, C. (2018). Classifying encrypted VPN traffic using deep learning-based identification. IEEE Access, 6, 62052-62061.
Al-Tahat, T., Harb, S., & Wahsheh, H. (2018). Classifying VPN traffic using machine learning techniques. 2018 9th International Conference on Information Technology (ICIT), 119-124.
Chen, K., & Tian, H. (2019). VPN traffic identification based on machine learning algorithms. 2019 IEEE 2nd International Conference on Information Systems and Computer Aided Education (ICISCAE), 70-73.
Cai, Z., Wang, M., Yu, S., & Zhou, W. (2018). A method for encrypted VPN traffic classification based on machine learning. 2018 2nd IEEE Advanced Information Management, Communicates, Electronic and Automation Control Conference (IMCEC), 1938-1943.
Li, L., Zeng, L., Sun, J., & Zhang, G. (2020). A traffic classification method for encrypted VPN based on machine learning. EURASIP Journal on Wireless Communications and Networking, 2020(1), 1-14.
Li, J., Shen, H., Luo, X., & Hu, Z. (2019). Encrypted VPN traffic identification using machine learning algorithms. 2019 International Conference on Computing, Networking and Communications (ICNC), 711-715.
Huang, H., Zhang, X., Liu, Y., Liu, Y., & Peng, X. (2019). Traffic classification of encrypted VPN based on machine learning. Security and Communication Networks, 2019, 1-12.
Ye, X., Zhou, Y., Yang, J., & Zheng, J. (2018). Encrypted VPN traffic identification based on machine learning. 2018 IEEE International Conference on Big Data and Smart Computing (BigComp), 1-6.
Ma, Z., Zhang, Y., & Wang, S. (2020). A machine learning-based encrypted VPN traffic classification method. Proceedings of the 2020 5th International Conference on Computer and Communication Systems, 437-440.
Guo, Y., & Li, M. (2019). Encrypted VPN traffic identification using machine learning and flow features. 2019 2nd IEEE International Conference on Computer Communication and the Internet (ICCCI), 1-5.
Mekki, K., Zemmari, A., & Moussaoui, S. (2020). Machine learning-based classification of encrypted VPN traffic. International Journal of Communication Systems, 2020, 1-13.
Khan, W. Z., Pervez, Z., Alvi, M. S., & Saba, T. (2020). Encrypted VPN traffic classification using machine learning algorithms. Proceedings of the 2020 12th International Conference on Computational Intelligence and Communication Networks (CICN), 1-5.
Shinde, V. S., & Ghorpade, G. (2019). Classification of VPN traffic using machine learning techniques. 2019 IEEE International Conference on Distributed Computing, VLSI, Electrical Circuits and Robotics (DISCOVER), 1-5.
Naouali, I., Rezgui, A., & Belgacem, N. (2018). A new machine learning-based approach for encrypted VPN traffic classification. Journal of Ambient Intelligence and Humanized Computing, 9(6), 1867-1878.
Siddiqui, M. J., Hameed, A., & Saleem, K. (2019). Encrypted VPN traffic classification using deep learning approach. 2019 10th International Conference on Computing, Communication and Networking Technologies (ICCCNT), 1-5.
Chen, S., Zhang, J., Liu, Q., & Li, H. (2017). Traffic classification for encrypted VPN based on machine learning. 2017 36th Chinese Control Conference (CCC), 7499-7504.
Iqbal, M., Khan, W. Z., Khan, F. H., & Saba, T. (2020). Encrypted VPN traffic classification using machine learning algorithms. IEEE Access, 8, 70089-70099.
Zhang, C., Fu, J., He, H., & Chen, Y. (2021). A hybrid machine learning approach for encrypted VPN traffic classification. Cluster Computing, 24(2), 1379-1390.
Cai, Z., Zeng, S., Li, Y., & Chen, K. (2020). Encrypted VPN traffic classification based on deep learning. Journal of Ambient Intelligence and Humanized Computing, 11(6), 2395-2405.
Khalid, S., Rizvi, S. A. R., & Naqvi, S. A. R. (2019). Classifying encrypted VPN traffic using machine learning: A comparative analysis. 2019 5th International Conference on Computing, Communication and Security (ICCCS), 1-5.
Wu, Y., Yan, G., Yu, C., & Xu, H. (2018). Encrypted VPN traffic identification based on machine learning. 2018 7th International Conference on Computer Science and Network Technology (ICCSNT), 277-281.
Almeida, A., Rossi, D., & Wille, E. (2019). A machine learning-based approach to classify VPN traffic in the presence of noise. Proceedings of the 2019 International Symposium on Networks, Computers and Communications (ISNCC), 1-6.
Gao, X., Gong, X., & Zhang, J. (2021). Encrypted VPN traffic classification based on multi-layer perceptron network. Frontiers in Artificial Intelligence, 4, 636979.
Zeng, L., Yang, J., Han, M., & Yang, Y. (2019). Encrypted VPN traffic identification based on machine learning and feature selection. Future Internet, 11(7), 145.
Islam, M. M., & Nishihara, A. (2020). Encrypted VPN traffic classification using machine learning: A comparative study. Proceedings of the 12th International Conference on Agents and Artificial Intelligence (ICAART), 2, 484-491.

Download PDF

Journal Publication

published 01 Jan, 2024

Read the published version in Computers, Materials & Continua →

Version 1

posted

You are reading this latest preprint version

Classified Vpn Network Traffic Flow Using Time Related to Artificial Neural Network

Status:

Journal Publication

Version 1

Abstract

Figures

1. Introduction

2. BACKGROUND

3. METHODOLOGY

3.1. Dataset Details

3.2. Pre-Processing and Data Augmentation Layers of ANN

3.3. Feature Extraction of Different Types of Traffic

3.4. Classification of VPN and Non-VPN

3.5. Training and Testing of VPN Traffic Flow Classification

4. RESULTS

5. DISCUSSION

6. CONCLUSION

Declarations

References

Status:

Journal Publication

Version 1